{"record":{"id":"dec9b4f893686759","repo":"BerriAI/litellm","slug":"azure-sentinel-endpoint-is-required-set-it-as-an","errorCode":null,"errorMessage":"AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter.","messagePattern":"AZURE_SENTINEL_ENDPOINT is required\\. Set it as an environment variable or pass endpoint parameter\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/integrations/azure_sentinel/azure_sentinel.py","lineNumber":109,"sourceCode":"        resolved_endpoint: Final = endpoint or os.getenv(\"AZURE_SENTINEL_ENDPOINT\")\n        resolved_tenant_id: Final = tenant_id or os.getenv(\"AZURE_SENTINEL_TENANT_ID\") or os.getenv(\"AZURE_TENANT_ID\")\n        resolved_client_id: Final = client_id or os.getenv(\"AZURE_SENTINEL_CLIENT_ID\") or os.getenv(\"AZURE_CLIENT_ID\")\n        resolved_client_secret: Final = (\n            client_secret or os.getenv(\"AZURE_SENTINEL_CLIENT_SECRET\") or os.getenv(\"AZURE_CLIENT_SECRET\")\n        )\n        resolved_authority_host: Final = self._normalize_authority_host(\n            authority_host\n            or os.getenv(\"AZURE_SENTINEL_AUTHORITY_HOST\")\n            or os.getenv(\"AZURE_AUTHORITY_HOST\")\n            or DEFAULT_AZURE_AUTHORITY_HOST\n        )\n\n        if not resolved_dcr_immutable_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter.\"\n            )\n        if not resolved_endpoint:\n            raise ValueError(\n                \"AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter.\"\n            )\n        if not resolved_tenant_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter.\"\n            )\n        if not resolved_client_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter.\"\n            )\n        if not resolved_client_secret:\n            raise ValueError(\n                \"AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter.\"\n            )\n\n        self.dcr_immutable_id = resolved_dcr_immutable_id\n        self.stream_name = resolved_stream_name\n        self.audit_stream_name = resolved_audit_stream_name","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/integrations/azure_sentinel/azure_sentinel.py#L91-L127","documentation":"The Azure Sentinel logger needs the Log Analytics data collection endpoint (the ingestion URL of your workspace) to POST logs to. It resolves endpoint from the constructor parameter or AZURE_SENTINEL_ENDPOINT, and raises ValueError when both are empty. The URL is combined with the DCR immutable ID and stream name to form the final ingestion path.","triggerScenarios":"Initializing AzureSentinelLogger with neither the endpoint parameter nor AZURE_SENTINEL_ENDPOINT set; env var misspelled or scoped to the wrong process; endpoint value present but empty string.","commonSituations":"Not knowing which endpoint Azure expects (it is the workspace's ingest URL like https://<workspace>-<suffix>.<region>.ingest.monitor.azure.com, from Tables > Data collection endpoint, not the portal URL); rotating to a new workspace without updating env vars; deploying with a partial secret set.","solutions":["Find the endpoint in Azure Portal: Log Analytics workspace > Tables > Data collection endpoint (or via az rest on the table resource), then export AZURE_SENTINEL_ENDPOINT=<that URL>","Or pass endpoint=... directly to the AzureSentinelLogger constructor","Verify the value is a full https:// ingestion URL for the correct region","Check the other four required Sentinel settings are also set (DCR ID, tenant, client id, secret) — init validates each"],"exampleFix":"# before\nAzureSentinelLogger(dcr_immutable_id=dcr_id, tenant_id=t, client_id=c, client_secret=s)  # missing endpoint\n\n# after\nAzureSentinelLogger(\n    dcr_immutable_id=dcr_id,\n    endpoint=\"https://myworkspace-0dgb.eastus.ingest.monitor.azure.com\",\n    tenant_id=t, client_id=c, client_secret=s,\n)","handlingStrategy":"validation","validationCode":"import os\nfrom urllib.parse import urlparse\n\nendpoint = os.getenv(\"AZURE_SENTINEL_ENDPOINT\", \"\")\nparsed = urlparse(endpoint)\nassert parsed.scheme == \"https\" and \".ingest.monitor.azure.com\" in parsed.netloc, \\\n    f\"AZURE_SENTINEL_ENDPOINT must be a Log Analytics ingestion URL, got {endpoint!r}\"","typeGuard":"def is_ingest_endpoint(url: str | None) -> bool:\n    if not url:\n        return False\n    p = urlparse(url)\n    return p.scheme == \"https\" and \"ingest\" in p.netloc and p.netloc.endswith(\"azure.com\")","tryCatchPattern":"try:\n    AzureSentinelLogger()\nexcept ValueError as e:\n    if \"AZURE_SENTINEL_ENDPOINT\" in str(e):\n        raise SystemExit(\"Set AZURE_SENTINEL_ENDPOINT to the workspace Data collection endpoint URL\") from e\n    raise","preventionTips":["Copy the endpoint from Log Analytics workspace > Tables > Data collection endpoint, not the portal URL","Include the endpoint in a config-validation test that runs in CI","Store endpoint and DCR ID together; they are both created in the same Portal flow"],"tags":["azure","azure-sentinel","logging-callback","environment-variables","configuration"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}